Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openc3 | rubygems | >= 5.12.0, <= 7.2.1 | 7.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the OpenC3::PluginModel.install_phase2 function, specifically in how it executed the pipinstall command. The pypi_url setting, which is user-controlled and not properly validated in the vulnerable version, was directly interpolated into a command string (pip_args). This string was then executed using Ruby's backtick operator (e.g., `/openc3/bin/pipinstall #{pip_args}`). The backtick operator, by design, passes the command to the system's shell (/bin/sh -c), allowing any shell metacharacters within the pypi_url to be interpreted and executed. This enabled authenticated users to inject arbitrary OS commands. The patch addresses this by switching to Open3.capture2e, which allows executing a command with an array of arguments, thus preventing shell interpretation of the pypi_url value. Additionally, a new PypiUrl.validate utility was introduced to ensure the pypi_url is a valid HTTP(S) URL, further mitigating the risk.
OpenC3::PluginModel.install_phase2openc3/lib/openc3/models/plugin_model.rb